Clark-Wilson
Biba only addresses one of three key integrity goals. The Clark-Wilson model improves on Biba by focusing on integrity at the transaction level and addressing three major goals of integrity in a commercial environment.
3 slides · 1 min read · Domain 3
To address the second goal of integrity, Clark and Wilson realized they needed a way to prevent authorized subjects from making undesirable changes. This required that transactions by authorized subjects be evaluated by another party before they were committed to the model system.
This provided separation of duties where the powers of the authorized subject were limited by another subject given the power to evaluate and complete the transaction. To address internal consistency (or consistency within the model system itself, Clark and Wilson recommended a strict definition of well-formed transactions. In other words, the set of steps within any transaction would need to be carefully designed and enforced. Any deviation from that expected path would result in a failure of the transaction to ensure that the model system's integrity was not compromised. To control all subject and object interactions, Clark-Wilson establishes a system of subject-program-object bindings such that the subject no longer has direct access to the object. Instead, this is done through a program with access to the object. This program arbitrates all access and ensures that every interaction between subject and object follows a defined set of rules. The program provides for subject authentication and identification and limits all access to objects under its control.